Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

Librsvg: use-after-free when xml includes have duplicated entities

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Emacs: emacs: arbitrary code execution in flymake mode

Gimp: integer overflow when generating a thumbnail preview for a psd file

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Emacs: emacs: command injection via crafted filenames in tramp

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

USB: serial: kl5kusb105: fix bulk-out buffer overflow

drm/gem: Try to fix change_handle ioctl, attempt 4

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

ice: fix double-free of tx_buf skb

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

xfrm: hold dev ref until after transport_finish NF_HOOK

Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

Bluez: stack overflow in name2utf8 causes dos and potential code execution

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

Spice-server: spice: heap oob read/write via unchecked migration data offsets

Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Cockpit: cockpit: denial of service via unbounded connection thread spawning

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

Pcp: pcp: denial of service due to signed integer overflow

Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malformed png